summaryrefslogtreecommitdiff
path: root/Documentation/SecurityBugs
diff options
context:
space:
mode:
authorArnd Bergmann <arnd@arndb.de>2015-03-11 22:46:59 +0100
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2015-03-26 15:00:55 +0100
commit895652af317379b0347353b00bca9d1bb26335bb (patch)
treec05b0f9de4ba27aceda80af437a22cdbe866fa8d /Documentation/SecurityBugs
parente2f572a9be3f00bcf470a918d9e53353bea9ef4c (diff)
rds: avoid potential stack overflow
[ Upstream commit f862e07cf95d5b62a5fc5e981dd7d0dbaf33a501 ] The rds_iw_update_cm_id function stores a large 'struct rds_sock' object on the stack in order to pass a pair of addresses. This happens to just fit withint the 1024 byte stack size warning limit on x86, but just exceed that limit on ARM, which gives us this warning: net/rds/iw_rdma.c:200:1: warning: the frame size of 1056 bytes is larger than 1024 bytes [-Wframe-larger-than=] As the use of this large variable is basically bogus, we can rearrange the code to not do that. Instead of passing an rds socket into rds_iw_get_device, we now just pass the two addresses that we have available in rds_iw_update_cm_id, and we change rds_iw_get_mr accordingly, to create two address structures on the stack there. Signed-off-by: Arnd Bergmann <arnd@arndb.de> Acked-by: Sowmini Varadhan <sowmini.varadhan@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'Documentation/SecurityBugs')
0 files changed, 0 insertions, 0 deletions